denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,401 Commits 1 Branch 0 Tags
c98e48cf0ecc9563166f2e7d009462c01fc3fb6e
Commit Graph
125 Commits
Author SHA1 Message Date
Tobias Brunner c98e48cf0e child-cfg: Add setting that controls whether outbound FWD policies are installed 2016-09-28 17:56:43 +02:00
Andreas Steffen 393688aea0 Created newhope plugin implementing the New Hope key exchange algorithm 2016-08-10 14:22:00 +02:00
Tobias Brunner f2ea230b91 child-cfg: Add option to prefer supplied proposals over locally configured ones 2016-06-17 18:48:07 +02:00
Tobias Brunner 3a40d572c6 ike-cfg: Add option to prefer supplied proposals over locally configured ones 2016-06-17 18:48:07 +02:00
Tobias Brunner f5e8bc18fd proposal: Remove MODP_NONE from IKE proposals parsed from strings 2016-06-17 18:48:07 +02:00
Tobias Brunner aae9510148 proposal: Handle MODP_NONE in both directions when selecting proposals 2016-06-17 18:48:07 +02:00
Andreas Steffen b1df631212 vici list-conns sends reauthentication and rekeying time information 2016-05-04 18:13:52 +02:00
Tobias Brunner fae18fd201 proposal: Remove some weaker and rarely used DH groups from the default proposal 
This fixes an interoperability issue with Windows Server 2012 R2 gateways.
They insist on using modp1024 for IKE, however, Microsoft's IKEv2
implementation seems only to consider the first 15 DH groups in the proposal.
Depending on the loaded plugins modp1024 is now at position 17 or even
later, causing the server to reject the proposal.  By removing some of
the weaker and rarely used DH groups from the default proposal we make
sure modp1024 is among the first 15 DH groups.  The removed groups may
still be used by configuring custom proposals.
 2016-05-04 11:33:28 +02:00
Andreas Steffen c26e4330e7 Implemented IPsec policies restricted to given network interface 2016-04-09 16:51:02 +02:00
Andreas Steffen 7f57c4f9fb Support manually-set IPsec policy priorities 2016-04-09 16:51:01 +02:00
Tobias Brunner 2ba5dadb12 peer-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Tobias Brunner 8a00a8452d child-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 622c2b2c33 peer-cfg: Add method to atomically replace child configs 2016-03-08 10:21:58 +01:00
Tobias Brunner 8db4f19ad9 ike-cfg: Use new method to compare proposal lists in equals() 2016-03-08 10:21:57 +01:00
Tobias Brunner f6a5e6b6a9 peer-cfg: Use new method to compare linked lists in equals() 
This also compares the complete lists not only the first two items.
 2016-03-08 10:21:57 +01:00
Tobias Brunner 3af23606bf child-cfg: Add equals() method 2016-03-08 10:21:57 +01:00
Tobias Brunner b4ae9e81f5 peer-cfg: Set DPD timeout to at least DPD delay 
If DPD timeout is set but to a value smaller than the DPD delay the code
in task_manager_v1.c:queue_liveliness_check will run into an integer
underrun.
 2016-02-01 15:29:25 +01:00
Andreas Steffen a78e1c3b11 128 bit default security strength for IKE and ESP algorithms 
The default ESP cipher suite is now
    AES_CBC-128/HMAC_SHA2_256_128
and requires SHA-2 HMAC support in the Linux kernel (correctly implemented
since 2.6.33).

The default IKE cipher suite is now
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
if the openssl plugin is loaded or
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
if ECC is not available.

The use of the SHA-1 hash algorithm and the MODP_2048 DH group has been
deprecated and ENCR_CHACHA20_POLY1305 has been added to the default
IKE AEAD algorithms.
 2015-12-17 17:49:48 +01:00
Tobias Brunner ebeb8c87c5 traffic-selector: Don't end printf'ed list of traffic selectors with a space 2015-11-10 12:13:06 +01:00
Tobias Brunner c605a96d7f Fix some Doxygen issues 2015-08-27 12:03:11 +02:00
Tobias Brunner 6bfa660693 ike-cfg: Add helper function to determine address family of IP addresses 
All configured static addresses (hostnames, ranges or subnets are not
considered) must be of the same family, otherwise AF_UNSPEC is returned.
 2015-07-27 11:59:37 +02:00
Tobias Brunner b1ef481ce1 proposal: Add default PRF for HMAC-MD5-128 and HMAC-SHA1-160 integrity algorithms 2014-10-31 10:09:54 +01:00
Tobias Brunner e0cd3bad3d ike-cfg: Use host_create_from_range() helper 2014-10-30 12:32:45 +01:00
Tobias Brunner f92399ef18 child-cfg: Ignore duplicate proposals 
If ESP proposals are added once with and once without DH groups
duplicates result during IKE_AUTH when DH groups are stripped.
 2014-09-12 10:18:14 +02:00
Tobias Brunner 8e52dc2733 proposal: Fix equals() 2014-09-12 10:18:13 +02:00
Martin Willi bdcaa5e680 child-cfg: Store connection specific replay window on CHILD_SA config 2014-06-17 15:42:02 +02:00
Martin Willi b9dd46d8a9 peer-cfg: Add missing UNIQUE_NEVER to unique_policy_names 2014-05-19 18:05:51 +02:00
Martin Willi 2f893f278d proposal: Don't return a default IKE proposal without encryption/AEAD algs 2014-05-16 16:51:19 +02:00
Martin Willi 356846db5d child-cfg: Allow passing NULL as proposal to add_proposal() 
Making the API consistent to the one of ike_cfg.
 2014-05-16 16:01:21 +02:00
Martin Willi 3312c447ef ike-cfg: Allow passing NULL to add_proposal() 
This simplifies adding default proposals with constructors potentially
returning NULL.
 2014-05-16 16:01:21 +02:00
Martin Willi 8642f8bdb7 proposal: Use an additional "default" constructor specific to AEAD algorithms 
This allows a caller to create a separated proposal for supported AEAD
algorithms, as required by RFC 5996.
 2014-05-16 16:01:21 +02:00
Martin Willi 0fc4dd429d proposal: Don't include AEAD algorithms in the default proposal 
According to RFC 5996 3.3 we should use a separate proposal for AEAD algorithms.
This was not clear in RFC 5282, hence we previously included both AEAD and
non-AEAD algorithms in a single proposal.
 2014-05-16 16:01:21 +02:00
Tobias Brunner c478dfe617 child-cfg: Fix removal of redundant traffic selectors 
We have to make sure we compare every selected traffic selector with every
other in the list.

Fixes #577.
 2014-04-25 19:04:35 +02:00
Tobias Brunner 23f34f6ed5 ike-cfg: Properly compare IKE proposals for equality 2014-04-03 09:46:41 +02:00
Tobias Brunner a213944d4a proposal: Don't fail DH proposal matching if peer includes NONE 
The DH transform is optional for ESP/AH proposals. The initiator can
include NONE (0) in its proposal to indicate that while it prefers to
do a DH exchange, the responder may still decide to not do so.

Fixes #532.
 2014-03-31 14:32:44 +02:00
Tobias Brunner ab13364c65 uclibc only defines strndup(3) if _GNU_SOURCE is defined 
References #516.
 2014-02-19 16:11:47 +01:00
Andreas Steffen 798a36dc14 Added NTRU key exchange to default IKE proposal 2013-11-27 20:21:41 +01:00
Tobias Brunner 7313499914 proposal: Add ECC Brainpool DH groups to the default proposal 2013-10-17 13:36:09 +02:00
Tobias Brunner dd438ee22c Doxygen fixes 2013-10-15 11:25:55 +02:00
Martin Willi f0c59e1cf8 proposal: Strip redundant integrity algos for ESP proposals only 2013-10-11 10:15:21 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 62282ec0ed backends: use ike_cfg host matching functions 2013-09-04 10:38:37 +02:00
Martin Willi 6f666192bb ike-cfg: add methods to match a host against configured local/remote addresses 2013-09-04 10:38:37 +02:00
Martin Willi e743275cae ike-cfg: add a method to resolve local/remote hosts with port 2013-09-04 10:38:36 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Martin Willi 2fa92ad256 proposal: correctly enumerate registered AEADs to build default IKE proposal 
AEADs are not returned (anymore) with the encryption enumerator.
 2013-07-19 15:05:17 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi c907b57f56 proposal: use array to store proposal list 
Removes another two linked lists (0.5KB) of memory per IKE/CHILD_SA pair.
 2013-07-17 17:20:18 +02:00